POPIA, PAIA & access to information

1. What this page is

This page is Pelicart’s manual under section 51 of PAIA. It doubles as Pelicart’s POPIA information page, so everything about access to information and personal information lives in one place.

It works together with the privacy policy (what we collect and why), the terms of service, and the security guide (how your data is protected).

2. Who Pelicart is, and who is in charge of your information

Pelicart is a WhatsApp assistant that builds Woolworths or Checkers Sixty60 grocery carts on your own store account. You review the cart and pay in the store’s own app. Pelicart cannot check out or pay.

The private body under PAIA and the responsible party under POPIA are the same company. Its chief executive officer is the head of the private body and its registered Information Officer.

• Private body: Pelicart (Pty) Ltd, a private company registered in South Africa under registration number 2026/398011/07
• Head of the private body and Information Officer: Caleb Rudnick, chief executive officer and director, registered with the Information Regulator
• Registered office, postal address, and company records location: 80 Strand Street, Cape Town, Western Cape, 8001, South Africa
• Email: caleb@pelicart.com
• Phone and WhatsApp: +27 60 522 3911
• Fax: not available
• Website: www.pelicart.com

3. The Regulator’s guide on how to use PAIA

The Information Regulator publishes a guide under section 10 of PAIA that explains, in each official language, how to use the Act: how to make a request, the fees, and the remedies available if a request is refused. The guide is free of charge from the Information Regulator:

• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Phone: 010 023 5200, or toll-free 0800 017 160
• Website: inforegulator.org.za
• eServices portal: eservices.inforegulator.org.za

4. Records that are automatically available

The following records are freely available on this website. You do not need a PAIA request to see them:

• the pricing page
• the security guide
• the privacy policy and terms of service
• this manual

5. Records created or kept under legislation

Pelicart creates and keeps these records under South African law:

• Companies Act 71 of 2008: registration certificate, Memorandum of Incorporation, director records, securities records, beneficial-ownership records, annual returns, and financial records
• Promotion of Access to Information Act 2 of 2000: this manual and access-request records
• Protection of Personal Information Act 4 of 2013: Information Officer registration, data-subject requests, objections, direct-marketing consents, operator agreements, security records, and security-compromise records
• Electronic Communications and Transactions Act 25 of 2002 and Consumer Protection Act 68 of 2008: subscription, transaction, cancellation, refund, and customer complaint records
• Tax Administration Act 28 of 2011 and Income Tax Act 58 of 1962: tax and accounting records

6. The records Pelicart holds

Pelicart holds the statutory records above and these service-related records:

• Customer records: your account and the WhatsApp profile data that comes with it (phone number, display name, first name)
• Conversation records: messages, media, transcripts, and related service records
• Shopping records: carts, order history, delivery addresses, and protected linked-store access data
• Billing records: subscription, invoice, payment-status, and accounting records
• Operational records: service-use, support, security, error, and analytics records
• Marketing records: marketing choices and referral records

7. How Pelicart processes personal information

This is a summary. The privacy policy has the full detail.

Purposes

Pelicart processes personal information to provide and support the service. This includes cart building, order tracking, delivery updates, and subscription billing. Pelicart also uses information for security, legal duties, and permitted marketing. Each marketing message includes an opt-out.

We also process it for support, security, service operation, performance checks, and fault resolution. Authorised people can review relevant records for these purposes.

Categories of data subjects

• Customers: account, WhatsApp profile, conversation, shopping, linked-store, billing, support, security, and service-use information
• Website visitors: website-use, referral, advertising-attribution, technical, and error information
• People who registered interest: contact, marketing-choice, and referral information
• Directors, shareholders, and beneficial owners: names, identifiers, addresses, appointments, ownership, securities, and statutory records
• Suppliers, service providers, and professional advisers: contact, contract, billing, payment, and compliance information

Recipients

Pelicart can supply personal information to these recipient categories. Each entry states what the category receives:

• Messaging: messaging providers receive account details, messages, and replies
• Artificial intelligence (AI): AI service providers receive conversation content and files needed to answer a request
• Hosting and storage: cloud providers hold account, linked-store, shopping, message, and technical data
• Analytics: analytics providers receive website, referral, service-use, and error data
• Billing: payment providers receive billing contact details, subscription data, and payment details entered on their hosted pages
• Tools: address and web-content providers receive the addresses, links, or searches needed for a request
• Support: support and booking providers receive the content and contact details that you submit to them
• Retailers: linked retailers receive the carts and orders on your account

Planned cross-border flows

Providers in the United States process message, AI, account, shopping, billing, address, web-content, and technical data. Providers in the European Union process support data. Section 72 of POPIA permits the transfer ground that Pelicart uses. Operator terms require suitable safeguards when local law gives less protection. These terms also control further transfers.

General security measures

Pelicart uses reasonable technical and organisational safeguards. These include encryption, access controls, monitoring, recovery controls, and provider checks. Operators have written security and confidentiality duties where POPIA requires them. The security guide explains these measures.

8. How to request access to records

You can first ask Pelicart for your own data without completing a form. Message “delete me” on WhatsApp to request account deletion, or email the Information Officer at caleb@pelicart.com for a copy or a correction. The privacy policy explains each of these routes.

To make a formal request for your own personal information, use section 23 of POPIA. Section 25 applies sections 18 and 53 of PAIA. For Pelicart, section 53 supplies the form and delivery rules. You do not need to identify another right to request your own information.

To request another company record that you need to exercise or protect a right, use section 50 of PAIA.

For either formal route, submit a form corresponding substantially with Form 2 of Annexure A to the 2021 PAIA Regulations to the Information Officer at caleb@pelicart.com. The form is available from the Regulator’s PAIA page. We respond within 30 days. If we need one further extension of up to 30 days, we tell you.

• Request fee: the fee set by Annexure B of the PAIA Regulations. Pelicart does not charge it when you ask for your own information.
• Reproduction fees: charges for copies, printouts, and search time, set by Annexure B of the PAIA Regulations

9. Your POPIA rights and the forms

Use Form 1 for an objection. Use Form 2 for a correction or deletion request. Email the request to the Information Officer at caleb@pelicart.com, message Pelicart on WhatsApp, or write to us in plain words. These requests are free of charge:

• Form 1: object to the processing of your personal information
• Form 2: request correction or deletion of your personal information. To ask for a copy of what Pelicart holds, use the PAIA route in section 8

Pelicart confirms the action taken on a correction or deletion request in writing within 30 days.

Direct-marketing consent

Pelicart uses Form 4, or an accessible equivalent, when it asks for direct-marketing consent. Pelicart sends the request to you. You can reply through the same free channel. Pelicart may ask only once.

Complaints to the Information Regulator

Send Form 5 to the Information Regulator, not to Pelicart. You can lodge the complaint by email or through the eServices portal:

• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Phone: 010 023 5200, or toll-free 0800 017 160
• Website: inforegulator.org.za
• eServices portal: eservices.inforegulator.org.za

10. Data breaches

Pelicart will investigate suspected unauthorised access to personal information. We will notify the Information Regulator and affected users as soon as reasonably possible.

11. Availability and updates of this manual

This manual is published free of charge at www.pelicart.com/popia. You can also inspect it at 80 Strand Street, Cape Town, Western Cape, 8001 during ordinary business hours.

Ask us for a copy by email from caleb@pelicart.com, against a reasonable charge for copying. The Information Regulator can request it from us at any time. We update it whenever a material detail changes.